CVE-2026-94127 is a critical zero-day vulnerability in F5 BIG-IP APM affecting instances configured as OAuth Authorization Servers with specific access policies and OAuth profiles on virtual servers. The flaw enables remote code execution and has been actively exploited in the wild. F5 has released security updates to fix the vulnerability and provided an iRule mitigation for immediate protection. The vulnerability is tracked by CISA, which has mandated U.S. federal agencies to patch promptly. Deployments using APM solely as OAuth Clients or Resource Servers without authorization server profiles are not vulnerable. Indicators of compromise include multiple OAuth authentication failures and suspicious commands followed by TMM SIGABRT events. Shadowserver tracks over 14,700 IPs with BIG-IP APM fingerprints, though the patch status of these is unknown.

The vulnerability allows remote code execution on affected BIG-IP APM systems configured as OAuth Authorization Servers, potentially enabling attackers to execute arbitrary commands. This poses significant risks to organizations relying on BIG-IP APM for centralized access management, including unauthorized access, network compromise, and data breaches. The flaw has been actively exploited, prompting urgent remediation directives from CISA for U.S. federal agencies. Deployments not configured as OAuth Authorization Servers are not impacted.

F5 has released official security updates that fix this vulnerability and should be applied immediately. For environments unable to patch promptly, F5 provides an iRule mitigation available from F5 Support to apply to the affected BIG-IP APM virtual servers. Customers are advised to monitor for indicators of compromise such as multiple OAuth authentication failures and suspicious commands followed by TMM SIGABRT events. Follow F5's official advisory for detailed remediation steps and apply patches as soon as possible.